Hello Jackkang,
Windows is limited to 3975 TCP connections open at any given time. A connection is used for every syslog message forwarded.
You will need to either change your "Forward to another host" action to use UDP or increase the number of TCP connections that can be handled and/or decrease the Wait Times for TCP connections. These are Windows options. More on this is found here:
SolarWinds Knowledge Base :: Why does the NETSTAT -A command list so many TCP/IP connections?
Hope this helps.
Sincerely,
Chris Foley